Out-of-Bounds Write Vulnerability in Eclipse ThreadX NetX Duo

CVE-2026-103416

What is CVE-2026-103416?

An out-of-bounds write vulnerability exists in the TLS 1.3 handshake message cache within Eclipse ThreadX NetX Duo version 6.5.1.202602. This flaw allows a handshake message that exceeds the cache size to overwrite adjacent memory, compromising the integrity of the session control block that contains critical pointers. Consequently, a malicious entity can exploit this vulnerability by sending a specially crafted TLS 1.3 message prior to the completion of server certificate authentication, enabling unauthorized access without valid credentials. This poses a significant risk to systems utilizing this version of NetX Duo.

References